Firewall configuration

A firewall is a named bundle of rules with a single mode and a single judge instance. The OpenAI client references the firewall by its slug, the platform calls the judge against the configured rules, and the decision flows back through the mode.

Firewall fields

Field	Notes
slug	URL-safe handle. The OpenAI client sends this as the firewall name.
name	Display name.
description	Free text.
mode	block \| allow \| audit. Controls what happens when a rule matches.
evaluator_serving_name	Chat instance used as the LLM judge. The firewall calls it once per request.
rule_slugs	Ordered list of rule slugs. Order matters when rules are aggregated.

firewall.json

1{
2  "slug": "customer-support",
3  "name": "Customer support",
4  "description": "Default firewall for the support assistant.",
5  "mode": "block",
6  "evaluator_serving_name": "judge-mini",
7  "rule_slugs": ["no-pii", "no-medical-advice", "refund-policy"]
8}

Modes

The mode is a single field on the firewall; it controls what happens when any of the configured rules matches.

Mode	Behavior
block	Match stops the request. The OpenAI client receives a 4xx with the matched rule slugs.
allow	Match is informational; the request continues with a header indicating which rules matched.
audit	Match is logged for later review. The request continues without interruption.

Attaching to an instance

Open the instance detail page, switch to the chat playground, and pick a firewall from the dropdown. The platform passes the firewall slug on the OpenAI request. The same flow is available from the chat playground component used by the dashboard.

For programmatic attachment, see Attaching a firewall in the Inference guide.